Trustworthy Attestable Decentralised Identity System (Tardis)

身份是一个重要的概念，它被用来表示一个实体，使它可以从同一空间中的其他一切中被识别出来。在数字世界中，我们既需要人类实体的身份，也需要虚拟对象的身份，通常在他们被允许执行某些行动或获取数据之前使用。然而，互联网不是一个可信的系统，身份格式由与人或其他系统交互的系统的所有者或设计者决定，安全控制往好了说是不一致的，往坏了说是不存在的。近年来，数字身份已被广泛用于包括法律验证在内的各种目的，而且这种趋势正在迅速增加。它利用人们的在线记录(例如，在线购买历史、社交媒体个人资料)以及他们的个人记录(例如，出生日期、护照号码)汇编在一起，形成一个识别符。然而，大多数身份系统是集中的，因此由当局拥有。权威机构对其系统中使用的所有身份数据拥有完全控制权。当谈到在全球化系统中共享数据时，例如为气候变化分析收集的数据，我们根本不能拥有单一的权威来源。下一个挑战是可信度的衡量。信任系统并不意味着一切都是值得信任的，同样，即使某个东西是值得信任的，它也不意味着它应该有权查看或访问一切。这项研究的主要目的是找出现有身份系统中的漏洞并解决安全问题。数据共享是我们日常生活的一部分，已经有如此多的问题没有得到优先考虑，比如上面强调的问题。在这项研究中，我们还将研究一种表示身份的新方法，该方法允许在安全的需要知道的基础上进行通信和数据共享，使用数字身份的多维属性及其所处环境的动态性质。所有者将选择要公开其个人数据的哪个子集，形成字节序列(例如，加密的)，该字节序列可以被安全地传输到可以建立信任并且可以确定可信性的分散系统。接收端将通告它们的服务所需的最小数据集以及它们用于可信性验证的授权。研究将分为三个主要阶段：1.现有设计和找出差距。在这个初始阶段，考虑到可测试性和可解释性，项目将收集定义“可信性”的需求。基于上一步的结果，这一阶段是为了寻求现代数字世界中身份危机的端到端解决方案。我们的建议是利用新的使用二元图形作为身份表示的表示，当与杏仁饼机制相结合时，我们将拥有一个分散的信任系统，其中(A)用户可以完全控制他们自己的身份；(B)可信性可以被测量和验证；以及(C)与中央系统相关的风险可以被降到最低，例如权力滥用和安全漏洞。检验并验证这一假设。我们将需要一个特意构建的分散式系统来模拟信息流，并在所有服务器上实施访问控制。将为评估提供一组方案，并为每个方案定义一个用例列表以及预期结果。所有身份都将使用Tardis二元符号表示，我们将使用Tardis对系统进行测试，以评估其准确性、有效性、安全性和性能。

Identity is an important concept, it is used to represent an entity in such a way that it can be identified from everything else in the same space. In the digital world we need identities for both human entities and virtual objects, typically used before they are permitted to carry out some action or obtain data. However, the internet is not a trusted system, identities formats are decided by the owners or designers of the systems that people or other systems interact with, and security control is inconsistent at best, inexistent at worst. Digital identity has become widely used in recent years for various purposes including legal verification, and this trend is rapidly increasing. It makes use of people's online records (e.g., online purchase history, social media profile) as well as their personal records (e.g., birth date, passport number) compiled together to form an identifier. However, majority of the identity systems are centralised and hence owned by an authority. The authoritative organisations have full control over all identification data used in their systems. When it comes to data being shared in a globalised system, for instance data gathered for climate change analysis, we simply cannot have a single source of authority. The next challenge is the measurement of trustworthiness. A trust system does not imply everything flows is trustworthy, equally even if something is trustworthy, it doesn't mean it should have the power to view or access everything. The main objective of this research is to identify the gaps in existing identity systems and to fix the security concerns. Data sharing is part of our everyday life and already so many problems such as the ones highlighted above are not being prioritised. In this research we will also look into a novel way to represent identities that allows communications and data sharing on a secure need-to-know basis, using multi-dimensional properties of digital identity and the dynamic nature of the context it is in. The owner would choose which subset of their personal data to be disclosed, form a sequence of bytes (e.g. encrypted) that can be transferred safely to a decentralised system where trust could be established and trustworthiness could be determined. The receiving end would have advertised what is the minimal set of data they need for their services and the authorit-y(-ies) they use for the trustworthiness validation. The research will be divided into three main stages:1. Existing design and identify gaps. During this initial stage the project will gather the requirements that define "trustworthiness", considering testability and explainability.2. Based on results from the previous step, this stage is to seek an end to end solution for the identity crisis in the modern digital world. The proposal is to make use of new representation using bigraph as the identity representation, which when combined with Macaroons mechanism we will have a decentralised trust system where (a) users have full control of their own identities; (b) trustworthiness could be measured and verified; and (c) risks associate with centralised system such as authority abuse and security vulnerabilities could be minimised.3. Test and verify the hypothesis. We will need a purposely built decentralised system to simulate the information flows with access control in place at all the servers. A set of scenarios will be provided for the evaluation, and for each scenario a list of use cases along with the expected results will be defined. All identities will be represented using Tardis bigraph notation, and we will test out the system using the Tardis to assess its accuracy, effectiveness, security and performance.